|Publication number||US7043587 B2|
|Application number||US 09/957,253|
|Publication date||May 9, 2006|
|Filing date||Sep 20, 2001|
|Priority date||Sep 20, 2001|
|Also published as||US20030056051|
|Publication number||09957253, 957253, US 7043587 B2, US 7043587B2, US-B2-7043587, US7043587 B2, US7043587B2|
|Inventors||Thomas Charles Burke, Daryl Carvis Cromer, Richard Alan Dayan, Eric Kern, Randall Scott Springfield|
|Original Assignee||Lenovo (Singapore) Pte. Ltd.|
|Export Citation||BiBTeX, EndNote, RefMan|
|Patent Citations (37), Non-Patent Citations (5), Referenced by (18), Classifications (7), Legal Events (5)|
|External Links: USPTO, USPTO Assignment, Espacenet|
1. Technical Field
The present invention relates in general to the field of computers, and in particular, to the interface and connection of computer peripheral devices to a computer system. Still more particularly, the present invention relates to an improved method and system for monitoring and controlling the connection of a Universal Serial Bus (USB) device to the computer system.
2. Description of the Related Art
Computer peripheral input/output (I/O) devices connect to a variety of data ports or external connectors of a host computer system, which includes a system processor and memory. One such port connector interface is the Universal Serial Bus (USB) interface, the specification of which is set forth in the generally available document entitled, “Universal Serial Bus Specification” release 2.0, Apr. 27, 2000 (USB.org), prepared by representatives of Compaq Computer Corporation, Hewlett-Packard Company, Intel Corporation, Lucent Technologies Inc., Microsoft Corporation, NEC Corporation, and Royal Philips Electronics (Philips). Peripheral device interfaces that comply with the specification are referred to as USB interfaces and have been included in many recently developed personal computer systems. Such USB devices are generally referenced as either low-speed devices, capable of transferring data at a rate of 1.5 Megabits per second (Mb/s); or high-speed devices (also called full-speed devices) capable of transferring data at 12 Mb/s. Under the USB 2.0 specification, full-speed devices are capable of using 40× multipliers for a transfer rate of 480 Mb/s, and such USB devices are typically known as true high-speed devices.
Within a personal computer system, a USB interface serves to provide well-known plug-n-play capability for personal computer peripherals such as external Compact Disc-Read Only Memory (CD-ROM) drives, joysticks, magnetic tape and floppy drives, external hard drives, scanners, and printers. Additionally, the USB interface allows an alternate connection for primary system input devices such as keyboards and mice, providing an alternative to the dedicated keyboard and mouse non-USB ports that many personal computer manufacturers provide. The industry generally refers to the non-USB keyboard and mouse ports as the PS/2 keyboard and PS/2 mouse port, respectively.
In a secured environment, control of the system configuration is one of the factors that should be considered. USB ports allow for easy insertion of peripheral devices to and from the computer system. However, this ease of addition of peripheral devices poses security problems. Easy addition of peripheral devices, especially those related to mass storage, can compromise the security of the computer system. By connecting an unauthorized mass data storage system, such as a magnetic floppy disk drive, harmful data such as fraudulent data or computer viruses may be loaded into the computer system. Further, sensitive data, such as proprietary or trade secret data, could be downloaded off the computer system into the unauthorized USB storage device.
In the prior art, connecting USB devices from a host computer system requires the involvement of the operating system of the host computer system. However, software associated with the operating system is typically non-secure, or at least easy to access, thus making it easy for an authorized programmer to modify the software to enable unauthorized USB device connect events.
It should therefore be apparent that there exists a need for a method and system that securely controls the addition of a USB device, and then preferably informs the owner of the computer system of its addition. Such a method and system preferably permit the owner, either manually or automatically through secure software, to allow or prevent an addition of the USB device. Further, it would be desirable to devise a system having the means to implement the USB device connection control method. In addition, it would also be desirable to devise a computer program product for monitoring and controlling an addition of a USB device.
The present invention relates to a method and system for controlling the addition of a USB device to a host computer system via a hardware hot plug detector that monitors USB ports. The differential signal lines connecting to the USB device are logically OR'ed together, such that logically high D+ or D− signals from the USB device signal a central processing unit's (CPU) system management interrupt (SMI) line to initiate system management mode (SMM). Entering SMM transfers control of the host computer system to an SMI Interrupt Handler BIOS, which resides in the SMM address space of the hose computer system. The SMM BIOS is loaded into the SMM address space during Power On Self Test (POST) and is secured prior to booting the Operating System (OS). The SMM BIOS code contains instructions as to whether or not the connected USB device should be made visible to the operating system of the computer. If the device is not authorized, it is disabled, the D+/D− lines are not connected to the USB host controller, and the SMI signal is cleared, allowing the computer to continue operation without the operating system ever being aware of the USB device.
The above, as well as additional objectives, features, and advantages in the present invention will become apparent in the following detailed written description.
The novel features believed characteristic of the invention are set forth in the appended claims. The invention itself, however, as well as the preferred mode of use, objects and advantages thereof, will best be understood by reference to the following detailed description of an illustrative embodiment when read in conjunction with the accompanying drawings, wherein:
With reference now to the drawings and in particular to
North bridge 12 is connected via a high-speed interconnect bus, preferably a proprietary bus, but alternatively a Peripheral Component Interconnect (PCI) bus, to a south bridge 16, a chip or chipset I/O arbiter that includes the necessary interface logic to convey signals from the high speed interconnect bus to (typically slower) I/O interfaces, including a super I/O 26. Super I/O 26 is typically a chip or chipset including necessary logic and interfaces for a parallel port 28 and a non-USB serial port 30, as are typically known and understood in the art. Super I/O 26 may also include controllers for non-USB devices such as a keyboard controller 32 for a non-USB keyboard and a floppy disk controller 34.
Associated with south bridge 16 is a USB host controller 18. USB host controller 18 includes differential data lines D+ and D−, which attach to USB hot plug detector 20, whose function and structure are further defined below. Differential data lines D+ and D− transmit both data and control signals for a USB device (not shown) according to protocols and standards understood by those skilled in the art of computer interfacing. Data and control signals are transmitted in mirrored positive and negative voltage to permit longer connection wires and to reduce signal noise and degradation. USB hot plug detector 20 is connected to USB port 22 via USB hub 25, preferably via differential lines D+ and D−, to USB host controller 18.
The USB topology in
Reference is now made to
In the preferred embodiment, SMM BIOS code is selective as to what type of function 24 may be connected. For example, functions 24 such as monitors, keyboards, and mice may be permitted to be connected, while mass storage devices such as floppy disk drives and CD-ROMs might not be authorized. If the USB device function 24 is authorized to be attached, the host computer system is then connected to the D+/D− lines of the USB device function 24, and enables the USB port 22 and addresses the USB device 24. The host computer system assigns a unique USB address to the USB device 24 and then determines if the newly attached USB device 24 is a hub or function. If the attached USB device is a hub and USB devices are attached to its ports 22, then the above procedure is followed for each of the attached USB devices. If the attached USB device is a function 24, then attachment notifications are handled by host software that is appropriate for the function.
If the device is not authorized to be connected according to the SMM BIOS code, the device is disabled, the D+/D− lines are not connected to USB host controller 18, the SMI interrupt is canceled, and the operating system of the host computer system's operating system never detects the USB device whose connection was attempted, as illustrated in block 48. Following the steps depicted in block 46 (an authorized connection event) or block 48 (termination of an unauthorized connection attempt), USB hot plug detector 20 resumes monitoring the D+ and D− lines for another connection event.
In an alternate preferred embodiment, a connection event by any USB device results in notification to a network server to which the host computer system is connected. The system administrator for the network may then take whatever steps are desired in response to the connection event, including rescinding connection authorization through the network and/or operating system level.
As has been illustrated by the above descriptions, the present invention provides a method and system for monitoring and controlling the connection of USB devices without initial notification of the operating system. Through the use of the intermediary hardware associated with USB hot plug detector 20, and the secure SMM BIOS code described above, connection events of USB devices can be securely monitored without initially notifying the O/S system of the host computer system. Thus, additional security is provided, since the more easily accessible operating system code is not the initial arbiter of authorization for connect events.
While the invention has been particularly shown and described with reference to a preferred embodiment, it will be understood by those skilled in the art that various changes in form and detail may be made therein without departing from the spirit and scope of the invention.
|Cited Patent||Filing date||Publication date||Applicant||Title|
|US5406260||Dec 18, 1992||Apr 11, 1995||Chrimar Systems, Inc.||Network security system for detecting removal of electronic equipment|
|US5796984||Jan 26, 1996||Aug 18, 1998||Dell Usa, L.P.||Operating system independent apparatus and method for eliminating peripheral device functions|
|US5821870||Apr 28, 1997||Oct 13, 1998||Jackson, Jr.; John T.||Monitored security switch assembly|
|US5854891||Aug 9, 1996||Dec 29, 1998||Tritheim Technologies, Inc.||Smart card reader having multiple data enabling storage compartments|
|US5926091||Mar 15, 1996||Jul 20, 1999||Tp Control Ab||Alarm system for computer equipment connected in a network|
|US5944840||Sep 10, 1997||Aug 31, 1999||Bluewater Systems, Inc.||Continuous monitor for interrupt latency in real time systems|
|US6029248||Dec 15, 1997||Feb 22, 2000||Lucent Technologies Inc. Corporation||Locking system to protect a powered component interface from erroneous access by an attached, powered-off component|
|US6064305||Jul 10, 1998||May 16, 2000||3Com Technologies||Network security|
|US6098171||Mar 31, 1998||Aug 1, 2000||International Business Machines Corporation||Personal computer ROM scan startup protection|
|US6104289||Jun 10, 1999||Aug 15, 2000||Protex International Corp.||Supervised anti-theft security system for product displays|
|US6128732 *||Dec 15, 1997||Oct 3, 2000||Compaq Computer Corporation||Implementing universal serial bus support with a minimum of system RAM|
|US6131134||Jul 27, 1998||Oct 10, 2000||Primax Electronics Ltd.||Hot plug-and-play converter of a universal serial bus interface|
|US6138240 *||Jun 19, 1998||Oct 24, 2000||Compaq Computer Corporation||Secure general purpose input/output pins for protecting computer system resources|
|US6147603||Nov 12, 1999||Nov 14, 2000||Protex International Corp.||Anti-theft computer security system|
|US6172606||Jun 4, 1999||Jan 9, 2001||3Com Technologies||Network security|
|US6205502||Dec 18, 1998||Mar 20, 2001||Alps Electric Co., Ltd.||Universal serial bus compatible peripheral device and universal serial bus controller which automatically switches between connection and disconnection of computer|
|US6216183||Nov 20, 1998||Apr 10, 2001||Compaq Computer Corporation||Apparatus and method for securing information entered upon an input device coupled to a universal serial bus|
|US6233640||Mar 19, 1999||May 15, 2001||In-System Design, Inc.||Universal serial bus peripheral bridge with sequencer|
|US6389560 *||Jan 19, 1999||May 14, 2002||Sun Microsystems, Inc.||Universal serial bus interpreter|
|US6393588 *||Nov 16, 1998||May 21, 2002||Windbond Electronics Corp.||Testing of USB hub|
|US6480801 *||Oct 19, 2001||Nov 12, 2002||Sun Microsystems, Inc.||Universal serial bus test system|
|US6505263 *||Jan 25, 2000||Jan 7, 2003||Dell U.S.A. L.P.||Bus controller operating code in system memory|
|US6567875 *||Apr 5, 1999||May 20, 2003||Opti, Inc.||USB data serializer|
|US6615288 *||Dec 27, 1999||Sep 2, 2003||Dell Products L.P.||Generating system management interrupt in response to usb controller signal and processing interrupt routine in upper most level of system memory|
|US6658515 *||Jan 25, 2000||Dec 2, 2003||Dell Usa, L.P.||Background execution of universal serial bus transactions|
|US6701401 *||Nov 7, 2000||Mar 2, 2004||Inventec Corporation||Method for testing a USB port and the device for the same|
|US20020095501 *||Jan 12, 2001||Jul 18, 2002||Chiloyan John H.||Method and system to access software pertinent to an electronic peripheral device based on an address stored in a peripheral device|
|US20020095540 *||Dec 29, 2000||Jul 18, 2002||Gateway, Inc.||USB hub with soft select ports|
|US20020156952 *||Mar 28, 2002||Oct 24, 2002||Atsuo Shono||Communication control apparatus, communication system and communication control method|
|US20020166072 *||May 2, 2001||Nov 7, 2002||International Business Machines Corporation||Data processing system and method for password protecting a boot device|
|US20030005197 *||Jun 29, 2001||Jan 2, 2003||Abramson Darren L.||Method and apparatus for deterministic removal and reclamation of work items from an expansion bus schedule|
|US20030041205 *||Feb 11, 2002||Feb 27, 2003||Wen-Jen Wu||USB compound device and the method for implementation thereof|
|US20030043771 *||Aug 6, 1998||Mar 6, 2003||Akihiko Mizutani||Connection establishment method, communication method, state change transmission method, state changing method wireless apparatus, wireless device, and computer|
|US20040162929 *||Feb 20, 2004||Aug 19, 2004||Gateway, Inc.||USB hub with soft select ports|
|US20050076171 *||May 20, 2004||Apr 7, 2005||Hanson Mark T.||Method and apparatus for detecting the type of interface to which a peripheral device is connected|
|EP0953486A2||Apr 30, 1999||Nov 3, 1999||CLARION Co., Ltd.||Automotive information system and method of controlling the same, recording medium storing control program, disk playback apparatus, and semiconductor integrated circuit|
|EP1031931A2||Jan 18, 2000||Aug 30, 2000||Sun Microsystems, Inc.||Universal serial bus interpreter|
|1||"Universal Serial Bus Specification", Revision 2.0, Chapter 7-Electrical, (Apr. 27, 2000), pp. 119-193.|
|2||IBM Corporation, "A Means to Reliably Determine the Steady State of a USB Plug-and-Play System", Research Disclosure; (Nov. 1999), p. 1544.|
|3||IBM Corporation, "Method to Identify Multiple identical USB Devices", Research Disclosure; (Feb. 1999), p. 258.|
|4||IBM Corporation, "Power Up Security for External Device Bay", Research Disclosure; (Mar. 1999), p. 392.|
|5||IBM Corporation, "Remote Detection of Configuration Changes of Hot-Plugable Devices", Research Disclosure; (Mar. 1999), p. 396.|
|Citing Patent||Filing date||Publication date||Applicant||Title|
|US7487222 *||Mar 29, 2005||Feb 3, 2009||International Business Machines Corporation||System management architecture for multi-node computer system|
|US7633348 *||Feb 15, 2007||Dec 15, 2009||Sonix Technology Co., Ltd.||Frequency-locking device and frequency-locking method thereof|
|US7913295||Apr 4, 2007||Mar 22, 2011||Microsoft Corporation||Method and apparatus to enable a securely provisioned computing environment|
|US8234433||Jul 1, 2009||Jul 31, 2012||Fujitsu Technology Solutions Intellectual Property Gmbh||Interface monitoring device, computer system, and method for monitoring a differential interface port|
|US8335931 *||Jun 20, 2008||Dec 18, 2012||Imation Corp.||Interconnectable personal computer architectures that provide secure, portable, and persistent computing environments|
|US8799539||Oct 18, 2006||Aug 5, 2014||Dell Products L.P.||Chipset agnostic apparatus and method for serial communication bus port disablement|
|US8904054 *||Mar 20, 2012||Dec 2, 2014||Sony Corporation||Method and apparatus for mode switching of interface ports|
|US20060224685 *||Mar 29, 2005||Oct 5, 2006||International Business Machines Corporation||System management architecture for multi-node computer system|
|US20080100388 *||Feb 15, 2007||May 1, 2008||Sonix Technology Co., Ltd.||Frequency-locking device and frequency-locking method thereof|
|US20080250476 *||Apr 4, 2007||Oct 9, 2008||Microsoft Corporation||Method and Apparatus to Enable a Securely Provisioned Computing Environment|
|US20090024746 *||Sep 25, 2003||Jan 22, 2009||Eric Welch||Method and apparatus for host controller operations over a network|
|US20090231045 *||Jun 1, 2009||Sep 17, 2009||Chih-Ming Liao||Frequency-locking device and frequency-locking method thereof|
|US20090319782 *||Jun 20, 2008||Dec 24, 2009||Lockheed Martin Corporation||Interconnectable personal computer architectures that provide secure, portable, and persistent computing environments|
|US20100023744 *||Jul 1, 2009||Jan 28, 2010||Ottwald Markel||Interface Monitoring Device, Computer System, and Method for Monitoring a Differential Interface Port|
|US20100332699 *||Dec 9, 2009||Dec 30, 2010||Fuji Xerox Co., Ltd.||Computer readable medium and information processing apparatus|
|DE102007005113A1||Feb 1, 2007||Aug 14, 2008||Fujitsu Siemens Computers Gmbh||Schnittstellenüberwachungsvorrichtung und Verfahren zum Überwachen eines Schnittstellenanschlusses|
|DE102008035103A1||Jul 28, 2008||Feb 11, 2010||Fujitsu Siemens Computers Gmbh||Schnittstellenüberwachungsvorrichtung, Computersystem und Verfahren zum Überwachen eines differenziellen Schnittstellenanschlusses|
|EP1953667A1||Jan 3, 2008||Aug 6, 2008||Fujitsu Siemens Computers GmbH||Interface monitoring device and method for monitoring an interface connection|
|U.S. Classification||710/302, 710/260, 710/304|
|International Classification||G06F9/445, G06F13/00|
|Sep 20, 2001||AS||Assignment|
Owner name: INTERNATIONAL BUSINESS MACHINES CORPORATION, NEW Y
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:BURKE, THOMAS CHARLES;CROMER, DARYL CARVIS;DAYAN, RICHARD ALAN;AND OTHERS;REEL/FRAME:012504/0094;SIGNING DATES FROM 20010918 TO 20010919
|Aug 4, 2005||AS||Assignment|
Owner name: LENOVO (SINGAPORE) PTE LTD., SINGAPORE
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:INTERNATIONAL BUSINESS MACHINES CORPORATION;REEL/FRAME:016891/0507
Effective date: 20050520
Owner name: LENOVO (SINGAPORE) PTE LTD.,SINGAPORE
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:INTERNATIONAL BUSINESS MACHINES CORPORATION;REEL/FRAME:016891/0507
Effective date: 20050520
|Dec 14, 2009||REMI||Maintenance fee reminder mailed|
|May 9, 2010||LAPS||Lapse for failure to pay maintenance fees|
|Jun 29, 2010||FP||Expired due to failure to pay maintenance fee|
Effective date: 20100509